The Resilience Benefits of a Backup-as-a-Service Solution – Part 2 

September is National Preparedness Month. This two-part blog details one possible solution to data management and recovery.  Part 1 can be found here. To learn more about Protiviti’s Business Continuity Management capabilities, click here. 

BaaS and Disaster Recovery Planning 

Disaster Recovery (DR) planning has two primary elements: recover the infrastructure and recover the data. 

Application architects are required to design solutions that meet specific Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO). RTO refers to the time to get the required backup application infrastructure up and running, whereas RPO refers to the time period for which data loss is permitted by the business use case, which could be from fractions of a second to hours or even days. 

The BaaS solution impacts both RTO and RPO:  Once the DR infrastructure is up and running, it can take time to identify, transfer and load a backup. The DR infrastructure itself could be either on-premise or on-cloud. Services such as Azure Site Recovery or AWS Cloud Endure aim to improve DR infrastructure cost and efficiency with automation of infrastructure recovery, for architectures which were not designed from the outset to exploit cloud technology.  

By fully exploiting cloud-based BaaS solutions, business can see significant benefits. For example, businesses which used the Azure Site Recovery and Azure Backup services had the following impact on their business operations: 

• 337 percent return on their investment over five years 
• 66 percent reduction in average data recovery time 
• 76 percent faster backups
• 51 percent improvement in efficiency of IT teams.

(Source: IDG) 

In general, businesses which plan to use cloud-based backup services should also consider either migrating their primary or their DR infrastructure to the same cloud, so the cloud-based DR service benefits can be more fully realized. 

Non-DR Recovery Scenarios 

Not all BaaS use cases are triggered by an enterprise-scale disaster. Data restores may be needed on-demand for many business-as-usual events, such as creating a test copy of data, recovering from a user error, issue investigation or simply performing a Disaster Recovery test. 

In these scenarios, restoring backups should be self-service, low-cost and reasonably timely (depending on the age and volume of the data). It is more likely that BaaS services will be used for these use cases than an outright disaster, and these use cases also serve as confirmation that backup and recovery solutions are behaving as expected. 

Key Pitfalls in using Modern BaaS 

When using cloud-based BaaS services, some key considerations apply: 

• Use automated policy enforcement to ensure all security and regulatory obligations are met 
• Regularly verify that the BaaS mechanisms for a system are functioning correctly and as expected – ideally after every major release (preferably via automated tests)
• Ensure operations staff can support cloud-based operations as well as on-premise operations
• Ensure performance expectations are being met (for example, by planning and monitoring recovery costs, transfer time, etc.)
• Ensure all systems are built and configured consistently to correctly and securely use the BaaS service – this may require validating OS and/or container images to ensure applications will work on both cloud and on-premise environments
• Ensure BaaS backup and restore solutions work in both DR environments as well as primary environments, as when a DR event occurs the DR environment becomes primary and therefore will require backups to continue from there. 

BaaS as part of an Enterprise Cloud Migration Strategy 

Many organizations may be nervous about moving their infrastructure aggressively to the cloud. Given the enhanced resilience that cloud solutions offer over traditional data center solutions, using cloud-based BaaS services may be a good way for teams to get exposure to using resilient cloud-based services without having to re-architect or re-engineer existing solutions.  

An example approach may look like this: 

1. Identify an appropriate cloud-based BaaS solution (e.g., Azure Backup or AWS Backup)
2. Identify applications which currently have high/redundant DR costs, and which are candidates for running on the cloud
3. Migrate these applications to use cloud-based data backup solutions (for primary and DR sites)
4. Migrate the DR environments for these applications to the cloud
5. Perform comprehensive DR test, and apply any remediations
6. Shut-down legacy DR
7. Plan migration of primary infrastructure to cloud based on infrastructure depreciation, etc.
8. Leverage cloud-based DR fail-over solutions to automate DR recovery. 

This approach should minimize re-engineering needs while enabling development and operations teams to become familiar with cloud technology and enabling the organization to take full advantage of the increased resilience offered by cloud services. 

Summary 

Backup-as-a-service can be adopted as a stand-alone capability focused on improving the cost and efficiency of data management for on-premise infrastructure, but the full benefits of cloud-based BaaS can best be achieved when aligned with an overall infrastructure DR strategy which also exploits the enhanced resilience of cloud-based solutions.  

For enterprises with hybrid cloud/on-premise environments, implementing a cohesive enterprise data management strategy can be difficult if different BaaS solutions are used for different environments. In these scenarios, vendor solutions are addressing a potential gap in the market. 

BaaS solutions which are not fully automated and capable of meeting the complex demands of modern enterprises will eventually be pushed to edge cases where the need for physical control of data exceeds cost and efficiency needs. For most enterprises, the future of resilient BaaS solutions is on the cloud where a path for on-premise architectures to take full advantage of these enhanced resilience capabilities can be constructed. 

To help organizations prepare and plan for disruptive events, Protiviti examines critical and pressing concepts about business continuity management and related practices in our Guide to Business Continuity Management and Resilience. Download the Guide today.